Argon2 Key Derivation with a Secret (Pepper), AD, and Encodings

Demonstrates the optional Argon2 options for Crypt2.Argon2DeriveKey: secret (a pepper), ad (associated data), the encoding member and its per-member overrides saltEncoding/secretEncoding/adEncoding, passwordCharset, and maxMemoryKb.

var
success: Boolean;
crypt: HCkCrypt2;
password: PWideChar;
json: HCkJsonObject;
bdKey: HCkBinData;
keyHex: PWideChar;

begin
success := False;

crypt := CkCrypt2_Create();

//  The password should come from a secure source rather than being hard-coded.
password := 'correct horse battery staple';

//  Build the Argon2 options JSON, this time using the optional secret, ad, and encoding members.
//    secret         the RFC 9106 secret value K, often called a "pepper": a key held by the
//                   application and NOT stored with the hash, so a stolen hash database cannot be
//                   attacked without it.
//    ad             optional associated data X: additional non-secret data bound into the derivation.
//    encoding       how salt, secret, and ad are encoded (default base64).  Per-member overrides are
//                   saltEncoding, secretEncoding, and adEncoding.
//    passwordCharset  the charset the password is converted to before use (default utf-8).
//    maxMemoryKb    a guard (not an Argon2 parameter) refusing to allocate more than this many KB;
//                   default 2097152 (2 GB).
json := CkJsonObject_Create();

//  The salt is provided here as hex, overriding the default base64 for just this member.
CkJsonObject_UpdateString(json,'salt','0102030405060708090a0b0c0d0e0f10');
CkJsonObject_UpdateString(json,'saltEncoding','hex');

//  The pepper is supplied as UTF-8 text (its own characters are the bytes).
CkJsonObject_UpdateString(json,'secret','application-wide-pepper');
CkJsonObject_UpdateString(json,'secretEncoding','utf-8');

//  Associated data, supplied as UTF-8 text.
CkJsonObject_UpdateString(json,'ad','user-id-42');
CkJsonObject_UpdateString(json,'adEncoding','utf-8');

CkJsonObject_UpdateString(json,'passwordCharset','utf-8');
CkJsonObject_UpdateInt(json,'maxMemoryKb',1048576);
CkJsonObject_UpdateInt(json,'keyLen',32);

bdKey := CkBinData_Create();
success := CkCrypt2_Argon2DeriveKey(crypt,password,CkJsonObject__emit(json),bdKey);
if (success = False) then
  begin
    Memo1.Lines.Add(CkCrypt2__lastErrorText(crypt));
    Exit;
  end;

keyHex := CkBinData__getEncoded(bdKey,'hex');
if (CkBinData_getLastMethodSuccess(bdKey) = False) then
  begin
    Memo1.Lines.Add(CkBinData__lastErrorText(bdKey));
    Exit;
  end;
Memo1.Lines.Add('Derived key: ' + keyHex);

CkCrypt2_Dispose(crypt);
CkJsonObject_Dispose(json);
CkBinData_Dispose(bdKey);